PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A base class for all the scanners checking appropriate process' features. More...
#include <process_feature_scanner.h>
Public Member Functions | |
ProcessFeatureScanner (HANDLE _processHandle) | |
virtual | ~ProcessFeatureScanner () |
virtual ModuleScanReport * | scanRemote ()=0 |
Protected Attributes | |
HANDLE | processHandle |
A base class for all the scanners checking appropriate process' features.
Definition at line 12 of file process_feature_scanner.h.
|
inline |
Definition at line 15 of file process_feature_scanner.h.
|
inlinevirtual |
Definition at line 20 of file process_feature_scanner.h.
|
pure virtual |
Perform the scan on the remote process
Implemented in pesieve::ArtefactScanner, pesieve::CodeScanner, pesieve::HeadersScanner, pesieve::IATScanner, pesieve::MappingScanner, pesieve::ModuleScanner, pesieve::ThreadScanner, and pesieve::WorkingSetScanner.
|
protected |
Definition at line 29 of file process_feature_scanner.h.